import 'package:flutter/material.dart';
import 'package:flutter_secure_storage/flutter_secure_storage.dart';

void main() => runApp(const MaterialApp(home: SecureVaultScreen()));

class SecureVaultScreen extends StatefulWidget {
  const SecureVaultScreen({super.key});
  @override
  State createState() => _SecureVaultScreenState();
}

class _SecureVaultScreenState extends State {
  // iOS: uses Keychain. Android: uses EncryptedSharedPreferences (AES-256)
  final _storage = const FlutterSecureStorage(
    aOptions: AndroidOptions(encryptedSharedPreferences: true),
    iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock),
  );
  final _tokenCtrl = TextEditingController();
  String? _displayedToken;
  static const _kTokenKey = 'auth_token';

  Future _save() async {
    final token = _tokenCtrl.text.trim();
    if (token.isEmpty) return;
    await _storage.write(key: _kTokenKey, value: token);
    _tokenCtrl.clear();
    if (!mounted) return;
    ScaffoldMessenger.of(context).showSnackBar(
      const SnackBar(content: Text('Token saved securely ✅'), backgroundColor: Colors.green),
    );
  }

  Future _read() async {
    final token = await _storage.read(key: _kTokenKey);
    setState(() => _displayedToken = token ?? '(no token stored)');
  }

  Future _delete() async {
    await _storage.delete(key: _kTokenKey);
    setState(() => _displayedToken = null);
    if (!mounted) return;
    ScaffoldMessenger.of(context).showSnackBar(
      const SnackBar(content: Text('Token deleted')),
    );
  }

  @override
  void dispose() { _tokenCtrl.dispose(); super.dispose(); }

  @override
  Widget build(BuildContext context) {
    return Scaffold(
      appBar: AppBar(title: const Text('Secure Vault')),
      body: Padding(
        padding: const EdgeInsets.all(24),
        child: Column(crossAxisAlignment: CrossAxisAlignment.stretch, children: [
          TextField(
            controller: _tokenCtrl,
            decoration: const InputDecoration(labelText: 'API Token', border: OutlineInputBorder()),
            obscureText: true,
          ),
          const SizedBox(height: 12),
          FilledButton(onPressed: _save, child: const Text('Save Securely')),
          const SizedBox(height: 8),
          OutlinedButton(onPressed: _read, child: const Text('Retrieve Token')),
          const SizedBox(height: 8),
          TextButton(onPressed: _delete, child: const Text('Delete Token', style: TextStyle(color: Colors.red))),
          if (_displayedToken != null) ...[
            const Divider(height: 32),
            Container(
              padding: const EdgeInsets.all(16),
              decoration: BoxDecoration(color: Colors.green.shade50, borderRadius: BorderRadius.circular(8)),
              child: Column(crossAxisAlignment: CrossAxisAlignment.start, children: [
                const Text('Retrieved (would hide in production):', style: TextStyle(fontWeight: FontWeight.bold)),
                const SizedBox(height: 8),
                Text(_displayedToken!, style: const TextStyle(fontFamily: 'monospace')),
              ]),
            ),
          ],
        ]),
      ),
    );
  }
}

// lib/config/app_config.dart — Reads compile-time constants
// Build with: flutter build apk --dart-define=API_KEY=abc123 --dart-define=BASE_URL=https://api.example.com

class AppConfig {
  // These are injected at COMPILE TIME — not readable from the binary
  // (unlike .env files which are bundled as plaintext assets)
  static const apiKey = String.fromEnvironment('API_KEY', defaultValue: '');
  static const baseUrl = String.fromEnvironment('BASE_URL', defaultValue: 'http://localhost:3000');
  static const isProduction = bool.fromEnvironment('PRODUCTION', defaultValue: false);

  static void validate() {
    assert(apiKey.isNotEmpty, 'API_KEY must be provided via --dart-define');
    assert(baseUrl.startsWith('https://') || !isProduction,
        'Production must use HTTPS');
  }
}

// Release build commands:
// Android:
// flutter build appbundle \\
//   --dart-define=API_KEY=secret123 \\
//   --dart-define=BASE_URL=https://api.example.com \\
//   --dart-define=PRODUCTION=true \\
//   --obfuscate \\
//   --split-debug-info=./debug_symbols
//
// iOS:
// flutter build ipa \\
//   --dart-define=API_KEY=secret123 \\
//   --obfuscate \\
//   --split-debug-info=./debug_symbols
//
// To verify no secrets in binary:
// strings build/app/outputs/apk/release/app-release.apk | grep -i secret
// (should return nothing)

class CertificatePinner {
  // Certificate pinning: only accept connections to servers
  // with a specific certificate, preventing MITM attacks.
  // In production, use `dio_certificate_pinning` package.
  static const List pinnedCertHashes = [
    'sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', // Replace with real hash
  ];
  // Generate hash: openssl s_client -connect api.example.com:443 | openssl x509 -pubkey | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | base64
}